View Full Fortinet NSE4_FGT-7.0 Exam Dumps and Practice Test Dumps

 

Question 161. Which FortiGate feature can identify a specific application even when the application does not consistently use its default TCP or UDP port?

1. Static routing
2. Application Control
3. DHCP relay
4. IP pool

Correct Answer: 2. Application Control

Explanation :-

Application Control identifies applications using FortiGate application signatures and traffic characteristics rather than depending solely on destination ports. This allows administrators to apply controls to applications even when they use non-standard ports or dynamic communication patterns. Static routing determines forwarding paths, DHCP relay forwards DHCP requests, and IP pools provide addresses for source NAT. Application Control is therefore the appropriate security feature when application identity needs to be used for traffic control independently of a fixed service port.

Question 162. A FortiGate administrator needs to permit HTTPS access to an internal server published through a virtual IP. Which service should normally be selected in the firewall policy?

1. DNS
2. FTP
3. HTTPS
4. DHCP

Correct Answer: 3. HTTPS

Explanation :-

If an internal server is published through a virtual IP specifically for secure web access, the firewall policy should permit the HTTPS service. The policy can reference the appropriate incoming interface, destination virtual IP, service, and required action. DNS, FTP, and DHCP are different protocols and do not represent standard HTTPS web traffic. Selecting HTTPS also keeps the policy appropriately restricted instead of allowing unnecessary services to the published server.

Question 163. Which FortiGate feature allows traffic to be inspected using antivirus, web filtering, application control, and other security profiles within a firewall policy?

1. Security profiles
2. Static routes
3. DHCP reservations
4. Interface zones

Correct Answer: 1. Security profiles

Explanation :-

Security profiles provide inspection and protection capabilities that can be associated with firewall policies. Depending on the FortiGate configuration, these can include Antivirus, Web Filter, Application Control, IPS, DNS Filter, and SSL/SSH inspection. Static routes determine forwarding, DHCP reservations provide predictable client addresses, and interface zones group interfaces. Security profiles are therefore the mechanism used to add security inspection and enforcement functions to traffic allowed through firewall policies.

Question 164. Which FortiGate feature can use a public IP address to publish an internal server to external clients?

1. Virtual IP
2. Address group
3. IP pool
4. Static route

Correct Answer: 1. Virtual IP

Explanation :-

A virtual IP, or VIP, can perform destination NAT by translating traffic sent to a public address toward an internal server address. A corresponding firewall policy is normally required to permit the intended traffic. An address group organizes address objects, an IP pool is generally used for source NAT, and a static route determines packet forwarding. A virtual IP is therefore the appropriate FortiGate object when an internal server needs to be published using a public destination address.

Question 165. Which FortiGate diagnostic command can help determine which firewall policy is processing a packet and why the packet is accepted or denied?

1. get system status
2. diagnose debug flow
3. execute ping
4. show firewall address

Correct Answer: 2. diagnose debug flow

Explanation :-

The diagnose debug flow facility provides detailed information about packet processing within FortiGate. It can help administrators identify routing decisions, policy matching, session handling, and reasons for acceptance or denial. get system status provides general system information, execute ping tests connectivity, and show firewall address displays address configuration. Debug flow is therefore particularly valuable when ordinary logs or policy inspection do not clearly explain why a packet is being processed in a particular way.

Question 166. Which FortiGate routing mechanism is normally used to advertise and learn routes dynamically with neighboring routers?

1. Dynamic routing protocol
2. IP pool
3. Web Filter
4. Virtual IP

Correct Answer: 1. Dynamic routing protocol

Explanation :-

Dynamic routing protocols allow FortiGate to exchange routing information with neighboring routers and automatically learn or advertise network prefixes. FortiGate supports protocols such as OSPF and BGP for appropriate network designs. IP pools provide source NAT addresses, Web Filter controls website access, and virtual IPs provide destination NAT. Dynamic routing is therefore appropriate when routing information needs to adapt automatically instead of relying exclusively on manually configured static routes.

Question 167. Which FortiGate feature can limit access to a service based on the day and time without creating a separate firewall policy for every time period?

1. Schedule
2. Address group
3. IPsec monitor
4. Application signature

Correct Answer: 1. Schedule

Explanation :-

A firewall policy schedule can define recurring periods during which the policy is active. This allows administrators to apply time-based access control without creating separate policies for every individual time interval. Address groups organize network objects, IPsec Monitor provides VPN status information, and application signatures identify applications. A schedule is therefore the appropriate mechanism when access to a network service should be limited according to specific days or times.

Question 168. Which FortiGate feature allows administrators to inspect the certificate presented by an HTTPS server without performing full content decryption?

1. Deep inspection
2. Certificate inspection
3. Antivirus
4. Traffic shaping

Correct Answer: 2. Certificate inspection

Explanation :-

Certificate inspection allows FortiGate to examine information from an SSL/TLS certificate and session without performing the same full content decryption used by deep inspection. This can provide useful visibility into encrypted connections while avoiding the broader interception and decryption requirements of deep inspection. Antivirus focuses on malicious content, while traffic shaping manages bandwidth. Certificate inspection is therefore suitable when administrators need to inspect certificate-related information without fully decrypting the HTTPS payload.

Question 169. Which FortiGate feature can combine several service objects so that they can be referenced as one logical service collection?

1. Service group
2. Address group
3. User group
4. IP pool

Correct Answer: 1. Service group

Explanation :-

A service group allows multiple service objects to be combined into one logical group. The group can then be referenced in firewall policies when several related protocols or ports need to be handled together. An address group combines network address objects, a user group combines authenticated identities, and an IP pool provides addresses for source NAT. Service groups are therefore useful for simplifying firewall policy configuration when several services should receive the same access treatment.

Question 170. An administrator wants to verify whether a FortiGate firewall policy is allowing traffic by examining historical session records. Which information should be reviewed?

1. Traffic logs
2. Firmware settings
3. Interface descriptions
4. DNS server configuration

Correct Answer: 1. Traffic logs

Explanation :-

Traffic logs contain information about sessions processed by FortiGate and can show details such as source and destination addresses, services, actions, interfaces, and policy identifiers. Reviewing these logs can help determine whether a policy allowed or denied a particular connection and provide historical evidence of traffic behavior. Firmware settings, interface descriptions, and DNS configuration do not provide equivalent session-level information. Traffic logs are therefore an important source for investigating past firewall-policy activity.

Question 171. Which FortiGate feature can provide automatic failover between two FortiGate appliances when the primary appliance becomes unavailable?

1. Web Filter
2. High Availability
3. Application Control
4. DNS Filter

Correct Answer: 2. High Availability

Explanation :-

FortiGate High Availability, or HA, allows multiple FortiGate appliances to operate as a cluster and provides redundancy when a member becomes unavailable. The HA cluster uses FGCP and heartbeat communication to monitor members and coordinate roles. Security profiles such as Web Filter, Application Control, and DNS Filter protect traffic but do not provide appliance-level failover. HA is therefore the appropriate feature when uninterrupted firewall service is required despite failure of a primary FortiGate unit.

Question 172. Which FortiGate command can display the status of the system, including the FortiOS firmware version?

1. execute ping
2. diagnose sniffer packet
3. get system status
4. show firewall policy

Correct Answer: 3. get system status

Explanation :-

The get system status command provides general information about the FortiGate system, including the installed FortiOS version and other device details. It is commonly used during troubleshooting and verification when an administrator needs to confirm the current software version or system state. execute ping tests connectivity, diagnose sniffer packet captures network packets, and show firewall policy displays policy configuration. System status is therefore the appropriate command for checking FortiOS version information.

Question 173. Which FortiGate feature can use domain categorization to block malicious or unwanted domains at the DNS level?

1. DNS Filter
2. Static route
3. IPsec Phase 1
4. Traffic shaper

Correct Answer: 1. DNS Filter

Explanation :-

DNS Filter evaluates DNS requests and can apply actions based on domain information and configured categories or security classifications. This provides a method of controlling access to unwanted or malicious domains at the DNS-resolution stage. Static routes determine packet forwarding, IPsec Phase 1 establishes VPN negotiation parameters, and traffic shapers control bandwidth. DNS Filter is therefore the appropriate FortiGate security feature when domain-based protection is required through DNS queries.

Question 174. A FortiGate administrator needs to restrict an administrative account so that it can manage only a specific VDOM. Which configuration concept is relevant?

1. Administrator profile and VDOM assignment
2. IP pool
3. Web Filter category
4. Static route

Correct Answer: 1. Administrator profile and VDOM assignment

Explanation :-

FortiGate administrative access can be controlled through administrator profiles and appropriate VDOM assignments. This allows organizations to limit administrators to specific virtual domains and restrict the operations they can perform according to their assigned permissions. IP pools support source NAT, Web Filter controls websites, and static routes determine forwarding. Administrator profiles and VDOM assignments are therefore relevant when implementing delegated administration and ensuring that an administrator can manage only the intended virtual firewall environment.

Question 175. Which FortiGate feature can inspect files for malware while traffic passes through a firewall policy?

1. Antivirus
2. ECMP
3. Policy route
4. Interface zone

Correct Answer: 1. Antivirus

Explanation :-

The FortiGate Antivirus security profile examines supported traffic for malicious files and malware-related content. When the profile is applied to an appropriate firewall policy, FortiGate can inspect traffic and take configured actions when threats are detected. ECMP provides equal-cost routing, policy routes influence forwarding, and interface zones group interfaces. Antivirus is therefore the security profile intended to provide malware inspection and protection for supported traffic passing through the firewall.

Question 176. Which FortiGate feature can provide a persistent management or routing endpoint that remains independent of the status of a particular physical port?

1. Loopback interface
2. Virtual IP
3. IP pool
4. DHCP relay

Correct Answer: 1. Loopback interface

Explanation :-

A loopback interface is a logical interface that does not depend directly on a specific physical interface being operational. Its address can provide a stable endpoint for management, monitoring, routing protocols, or other services. A virtual IP performs destination NAT, an IP pool provides addresses for source NAT, and DHCP relay forwards DHCP requests. A loopback interface is therefore useful when a consistent logical address is required regardless of the state of individual physical interfaces.

Question 177. Which FortiGate routing feature can use multiple equal-cost routes to improve path availability?

1. ECMP
2. Web Filter
3. Captive portal
4. Antivirus

Correct Answer: 1. ECMP

Explanation :-

Equal-Cost Multi-Path routing allows FortiGate to use multiple routes with equivalent routing characteristics. Depending on the configured behavior, this can provide path redundancy and distribute traffic across multiple available paths. Web Filter, captive portal, and Antivirus provide security or authentication functions rather than routing decisions. ECMP is therefore the appropriate routing feature when multiple equal-cost paths are available and the administrator wants FortiGate to use them for forwarding and resilience.

Question 178. Which FortiGate feature allows an administrator to create a policy that applies only to authenticated members of a particular group?

1. Identity-based policy
2. Static NAT
3. ECMP
4. Link aggregation

Correct Answer: 1. Identity-based policy

Explanation :-

Identity-based policies use authenticated user or group information as part of access-control decisions. An administrator can associate an appropriate user group with a policy so that only authenticated members of that group receive the specified access. Static NAT handles address translation, ECMP handles equal-cost routes, and link aggregation combines physical links. Identity-based policy is therefore appropriate when network access needs to be restricted according to authenticated user membership rather than only network addresses.

Question 179. Which FortiGate diagnostic tool is most appropriate for determining whether packets are entering an interface but being dropped later during processing?

1. Packet sniffer combined with debug flow
2. DHCP reservation
3. Web Filter category report only
4. Configuration backup

Correct Answer: 1. Packet sniffer combined with debug flow

Explanation :-

A packet sniffer can establish whether packets are actually entering the FortiGate interface, while debug flow can provide detailed information about how those packets are subsequently processed. Using both tools can help isolate whether the problem occurs at ingress, routing, policy matching, session processing, or another stage. DHCP reservations and configuration backups do not provide packet-processing evidence, and a Web Filter category report is too limited for general packet troubleshooting. Combining packet capture with debug flow provides broader diagnostic visibility.

Question 180. Which FortiGate feature is designed to control the amount of bandwidth consumed by selected traffic?

1. Traffic Shaping
2. IPsec VPN
3. Address Group
4. DHCP Server

Correct Answer: 1. Traffic Shaping

Explanation :-

Traffic Shaping allows administrators to control bandwidth consumption and manage how network resources are allocated among selected traffic. Depending on the configuration, shaping can impose bandwidth limits or prioritize particular traffic classes. IPsec VPN provides encrypted connectivity, Address Groups organize network addresses, and DHCP Server provides IP configuration to clients. Traffic Shaping is therefore the FortiGate feature specifically designed to regulate bandwidth usage and help maintain predictable network performance.